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In the paper we develop a method for constructing quantum algorithms for computing Boolean func- 
tions by quantum ordered read-once branching programs (quantum OBDDs). Our method is based 
on fingerprinting technique and representation of Boolean functions by their characteristic polynomi- 
als. We use circuit notation for branching programs for desired algorithms presentation. For several 
known functions our approach provides optimal QOBDDs. Namely we consider such functions as 
MOD m , EQ n , Palindrome n , and PERM„ (testing whether given Boolean matrix is the Permutation 
Matrix). We also propose a generalization of our method and apply it to the Boolean variant of the 
Hidden Subgroup Problem. 

1 Introduction 

During the last two decades different types of quantum computation models based on Turing Machines, 
automata, and circuits have been considered. For some of them different examples of functions were 
presented for which quantum models appear to be much more (exponentially) efficient than their classical 
counterparts. 

In this paper we consider a restricted model of computation known as Ordered Read-Once Quan- 
tum Branching Programs. In computer science this model is also known as Ordered Binary Decision 
Diagrams (OBDDs). The main reason for the investigation of restricted models of quantum computers 
was proposed by Ambainis and Freivalds in 1998 |1|. Considering one-way quantum finite automata, 
they suggested that first quantum-mechanical computers would consist of a comparatively simple and 
fast quantum-mechanical part connected to a classical computer. 

Two models of quantum branching programs were introduced by Ablayev, Gainutdinova, Karpinski 
[2] {leveled programs), and by Nakanishi, Hamaguchi, Kashiwabara ifTTI {non-leveled programs). Later 
it was shown by Sauerhoff lfl2l that these two models are polynomially equivalent. 

For this model we develop the, fingerprinting technique introduced in [6]. The basic ideas of this 
approach are due to Freivalds (e.g. see the book [10]). It was later successfully applied in the quantum 
automata setting by Ambainis and Freivalds in 1998 HI (later improved in Q). Subsequently, the same 
technique was adapted for the quantum branching programs by Ablayev, Gainutdinova and Karpinski in 
2001 |2], and was later generalized in |6j. 

For our technique we use the presentation of Boolean functions known as characteristic polynomials. 
Our definition of the characteristic polynomial differs from that of H, though it uses similar ideas. 

We display several known functions for which our method provides optimal QOBDDs. Namely, 
these functions are MOD m , EQ n , Palindrome,,, and PERM,,. 
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2 Preliminaries 



We use the notation \i) for the vector from 'K" ', which has a 1 on the i-th position and elsewhere. 
Obviously, the set of vectors 1 1),. . . ,\d) forms an orthonormal basis in "K d . 

Definition 1. A Quantum Branching Program Q over the Hilbert space "K d is defined as 

Q=(T,\XI/ ),Maccept), 

where T is a sequence of I instructions: Tj = (xi p U j(0) ,V y(l)) is determined by the variable X[. tested 
on the step j, and Uj(0), Uj{\) are unitary transformations in < K d . 

Vectors \ y) £ J{ d are called states (state vectors) ofQ, \ \j/o) £ 'K 4 is the initial state of Q, andM accept 
- is a projector on the accepting subspace "Kaccept (i- e - *t ™ a diagonal zero-one projection matrix, which 
determines the final projective measurement). 

We define a computation of Q on an input a = (0\ , <7„) G {0, 1}" as follows: 

1. A computation of Q starts from the initial state | Vb)»' 

2. The j-th instruction of Q reads the input symbol ov. (the value ofx{.) and applies the transition 
matrix Uj = Uj((Jij) to the current state |y/) to obtain the state = Uj((Jij) \ \jf); 

3. The final state is 

IV<t> = 

4. After the l-th (last) step of quantum transformation Q measures its configuration \y/ a )> an d the 
input o is accepted with probability 




Praccept{o) = (WaMlcceptlMacceptWa) 



\\M accep t \Wo)\\l. 



Circuit representation. A QBP can be viewed as a quantum circuit aided with an ability to read 
classical bits as control variables for unitary operations. That is any quantum circuit is a QBP which 
does not depend essentially on its classical inputs. 



IVb) 



r i*> -f 



) 



=0= 



Ui(0) 



U 2 (l) 



U 2 (0) 



Q 



Ui(0) 



Here x^ is the sequence of (not necessarily distinct) variables denoting classical control bits. 
Using the common notation single wires carry quantum information and double wires denote classical 
information and control. 
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Complexity measures. The width of Q is the dimension d of the state space 3{ d , the length of Q is the 
number / of instructions in the sequence T. 

Note that for a QBP in the circuit setting another important complexity measure explicitly comes out 
- a number q of qubits physically needed to implement a corresponding quantum system with classical 
control. From definition it follows that log d < q. 

Definition 2. We call a quantum branching program a q-qubit QBP, if it can be implemented as a 
classically-controlled quantum system based on q qubits. 

Acceptance criteria. A QBP Q computes the Boolean function f with one-sided error if there exists 
an e G (0, 1) (called an error) such that for all a G /~ 1 ( 1 ) the probability of Q accepting a is 1 and for 
all a G f~ x (0) the probability of Q erroneously accepting a is less than e. 

Read-once branching programs. 

Definition 3. We call a QBP Q a quantum OBDD fQOBDDj or read-once QBP if each variable x G 
{x\ ,x n } occurs in the sequence T of transformations of Q at most once. 

For the rest of the paper we're only interested in QOBDDs, i.e. the length of all programs would be 
n (the number of input variables). 

Generalized Lower Bound. The following general lower bound on the width of QOBDDs was proven 
in 0. 

Theorem 1. Let f{x\ , . . . ,x n ) be a Boolean function computed by a quantum read-once branching pro- 
gram Q. Then 

width(Q) = n(logwidth(P)) 
where P is a deterministic OBDD of minimal width computing f(x\ ,x n ). 

That is, the width of a quantum OBDD cannot be asymptotically less than logarithm of the width 
of the minimal deterministic OBDD computing the same function. And since the deterministic width of 
many "natural" functions is exponential [13], we obtain the linear lower bound for these functions. 

3 Algorithms for QBPs Based on Fingerprinting 

Generally [10], fingerprinting - is a technique that allows to present objects (words over some finite 
alphabet) by their fingerprints, which are significantly smaller than the originals. It is used in randomized 
and quantum algorithms to test equality of some objects (binary strings) with one-sided error by simply 
comparing their fingerprints. 

In this paper we develop a variant of the fingerprinting technique adapted for quantum branching 
programs. At the heart of the method is the representation of Boolean functions by polynomials of 
special type, which we call characteristic. 

3.1 Characteristic Polynomials for Quantum Fingerprinting 

We call a polynomial g(x\ ,...,x n ) over the ring Z m a characteristic polynomial of a Boolean function 
f(x\,. . . ,x n ) and denote it gf when for all a G {0, 1}" g/{o) = iff f(o) = 1. 

Lemma 1. For any Boolean function f there exists a characteristic polynomial gf over %2 n - 
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Proof. One way to construct such characteristic polynomial g f is transforming a sum of products repre- 
sentation for -if. 

Let K\ V . . . V K\ be a sum of products for -if and let Kj be a product of terms from Kj (negations -ixj 
are replaced by 1 —xj). Then K\ + . . . + Ki is a characteristic polynomial over for / since it equals 
<J=^ all of Kj (and thus Ki) equal 0. This happens only when the negation of / equals 0. □ 

Generally, there are many polynomials for the same function. For example, the function EQ n , which 
tests the equality of two /7-bit binary strings, has the following polynomial over Z2«: 

n n 

( x i( l -yd + i}- x i)yd = L ( x i+yi - ^0 • 
1=1 i=i 

On the other hand, the same function can be represented by the polynomial 

f>2'- 1 -f>2'- 1 . 

i=i (=1 

We use this presentation of Boolean functions for our fingerprinting technique which generalizes the 
algorithm for MOD m function by Ambainis and Nahimovs J5J. 

3.2 Fingerprinting technique 

For a Boolean function / we choose an error rate £ > and pick a characteristic polynomial g over 
the ring Z m . Then for arbitrary binary string a = 0\...o n we create its fingerprint \h a ) composing 
t = 2 pog((2/e)ln2m)l s in g i e qu bi t fingerprints |/i ! ff >: 

K) 

K) 

That is, the last qubit is rotated by t different angles about the y axis of the Bloch sphere. 

The chosen parameters ki G {1, . . . ,m— 1} for i G {1, . . . ,t} are "good" following the notion of (H. 

Definition 4. A set of parameters K = {ki,. . . ,k t } is called "good" for some integer b^O mod m if 

1 /' 2Tikib\ 2 

Air—) <e 

The left side of inequality is the squared amplitude of the basis state |0)® ogt |0) if b = g(o) and the 
operator //® lo § ? 0/ has been applied to the fingerprint \h a ). Informally, that kind of set guarantees, that 
the probability of error will be bounded by a constant below 1 . 

The following lemma proves the existence of a "good" set and generalizes the proof of the corre- 
sponding statement from (5J. 

Lemma 2. Ml/ There is a set K with \K\ = t = 2 r io s(( 2 / e ) ln2m )l which is "good" for all integer b / 
mod m. 

We use this result for our fingerprinting technique choosing the set K = {k\, ... ,k t } which is "good" 
for all b = g(o) 7^ 0. That is, it allows to distinguish those inputs whose image is modulo m from the 
others. 



cos 
j_ 



2?rt,-g(g) 
m 

L 10 \h 



sin 



2ft%(ff) 
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3.3 Boolean Functions Computable via Fingerprinting Method 

Let f(x\, . . . ,x n ) be a Boolean function and g be its characteristic polynomial. The following theorem 
holds. 

Theorem 2. Let e G (0, 1). If g is a linear polynomial over 7L m , i.e. g = c\x\ + ... c„x n + cq, then f can 
be computed with one-sided error e by a quantum OBDD of width O 

Proof. Here is the algorithm in the circuit notation: 

x\ 



|0i > -\H\ ^> 

102) 



H 



1 01ogr 
I* 



H 



-O 



-o 



-o 



-o 



RlA —■— R fM —■— /?1,0 Rt.O 



f\t) 



H 



T T 

Wo) lvi> 



T 



T 

V3> 



T T 

|V4> \Ys) 



Initially qubits |0i) <g> jifc) ®- • • ® |<frogz) ® l^sgtf) are in the state |y/b) = |0)® log ' |0). For i G {1, . . . ,/}, 
j € {0, . .. ,n} we define rotations Rjj as 



7? 



'■./ 



7? f 



AnkjCj 



m 



where cj are the coefficients of the linear polynomial for / and the set of parameters K = {k\ , . . . ,k t } is 
"good" according to the Definition g] with t = 2r i °g(( 2 /e)ta2-m)l_ 

Let a = G\ . . . o n £ {0, 1}" be an input string. 

The first layer of Hadamard operators transforms the state | Xjfo) i nto 



m) 



Next, upon input symbol identity transformation / is applied. But if the value of Xj is 1, then 
the state of the last qubit is transformed by the operator Ru, rotating it by the angle proportional to cj. 
Moreover, the rotation is done in each of t subspaces with the corresponding amplitude l/y/i. Such 
a parallelism is implemented by the controlled operators which transform the states \i) |-) into 

\i)Rij \ -}, and leave others unchanged. For instance, having read the input symbol x\ = 1, the system 
would evolve into state 



\¥z) = j ! iCi(Ri,i)\i)\0) = Xi\i}R ijl \0) 



St 



i=1 
t 



i=\ 



(=1 



7 I \i) cos^a|0)+sin^a|i; 
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Thus, after having read the input o the amplitudes would "collect" the sum c j G j 

|V3> = ^ I|«}(^cos ^ r ^|0)+sin ^ — ^ 1 1) J • 

At the next step we perform the rotations by the angle 4nkiC ° about the y axis of the Bloch sphere for 
each i £ {1, . . . ,t}. Therefore, the state of the system would be 

|V4> = ^IIO(cos^|0) + sin^|l)). 

Applying H® logt (g>/ we obtain the state 

|V5) = (llcos^l)|0) 8logf |0) + 

+r|of logf |i) + i|i)(a i |o)+ft|i}), 

i=2 

where 7, a,, and j3, are some unimportant amplitudes. 

The input a is accepted if the measurement outcome is |0}® log ' |0). Clearly, the accepting probability 

is 

, . 1 (± 2nk ig (o) 
ProcceptiP) = ^ I L cos 2 n 

If f{o) = 1 then g(a) = and the program accepts a with probability 1. Otherwise, the choice of 
the set K = {k\ , . . . , k t } guarantees that 

, , 1 2nk ig (o)\ 2 

Pracce P t(0) = ^ I £ COS I < £. 

Thus, / can be computed by a g-qubit quantum OBDD, where q = log2? = O(loglogm). The width 
of the program is 2 q = 0(log m). □ 

The following functions have the aforementioned linear polynomials and thus are effectively com- 
puted via the fingerprinting technique. 

MOD m The function MOD m tests whether the number of l's in the input is modulo m. The linear 
polynomial over Z,„ for this function is 

n 

i=l 

The lower bound for the width of deterministic OBDDs computing this function is Q(m) [13]. Thus, our 
method provides an exponential advantage of quantum OBDD over any deterministic one. 

EQ n The function EQ n , which tests the equality of two rc-bit binary strings, has the following polyno- 
mial over Z2« 
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Palindrome n {x\, . . . ,x n ) This function tests the symmetry of the input, i.e. whether X\X2- ■ -Xuni = 
x n x n ^i . ■ -JCrn/21+i or not. The polynomial over Z 2 l„/2j is 

L»/2J 

i=l i=[n/2] 

PERM,, The Permutation Matrix test function (PERM,,) is defined on « 2 variables (1 < £, j < «). It 
tests whether the input matrix contains exactly one 1 in each row and each column. Here is a polynomial 
over Z(„ +1 )2 n 

n n 2n 

£ £ x (7 ( (n + 1 )- 1 + (n + 1 1 ) - £ (n + 1 ) < 1 . 

1=1 7=1 i=l 

Note, that this function cannot be effectively computed by a deterministic OBDD - the lower bound 
is £1(2" n~ 5 1 2 ) regardless of the variable ordering ifTBl . The width of the best known probabilistic OBDD, 
computing this function with one-sided error, is 0(« 4 log?i) [ 13]. Our algorithm has the width 0(n\ogn). 
Since the lower bound Q.(n — logn) follows from TheoremQ] our algorithm is almost optimal. 

The following table provides the comparison of the width of quantum and deterministic OBDDs for 
the aforementioned functions. 





OBDD 


QOBDD 


MOD,,, 


Q(m) 


O(logm) 


EQn 


2 iW 


0(n) 


Palindrome,, 




0(n) 


PERM n 


a(2 n n- 5 ' 2 ) 


0(n\ogn) 



4 Generalized Approach 

The fingerprinting technique described in the previous section allows us to test a single property of the 
input encoded by a characteristic polynomial. Using the same ideas we can test the conjunction of several 
conditions encoded by a group of characteristic polynomials which we call a characteristic of a function. 

Definition 5. We call a set %™ of polynomials over Z m a characteristic of a Boolean function f if for all 
polynomials g £ %J and all a G {0, 1}" it holds that g(o) = iff G G f~ x (1). 

We say that a characteristic is linear if all of its polynomials are linear. 

From Lemma Q] it follows that for each Boolean function there is always a characteristic consisting 
of a single characteristic polynomial. 

Now we can generalize the Fingerprinting technique from section [3^21 

Generalized Fingerprinting technique For a Boolean function / we choose an error rate e > and 
pick a characteristic %J = {g\, . . . ,gi}. Then for arbitrary binary string a = Gi . . . o n we create its fin- 
gerprint \h a ) composing t - l (t = 2r io g(( 2 / e ) ln2m )l) single qubit fingerprints \h' a (j)y. 

KU)) = 

K) = 



cos n ' 0) + sin sn ' 1) 
jji\i)\hM)\hU2))---K(l)) 
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Theorem 3. If %™ is a linear characteristic then f can be computed by a quantum OBDD of width 

, |v'" I s 

0(2 lx f 1 logm). 

Proof. Here is the sketch of the algorithm: 

1. Upon the input a = <3\ . . . a n we create the fingerprint \h a ). 

2. We measure \h a ) in the standard computational basis and accept the input if the outcome of the 
last / qubits is the all-zero state. Thus, the probability of accepting a is 

Pr accept (ct) = - > COS Z COS Z . 

t -~j m m 

If /(ct) = 1 then all of gt(o) = and we will always accept. 

If /(ct) = then there is at least one such j that gj(o) / and the choice of the "good" set K 
guarantees that the probability of the erroneously accepting is bounded by 

accept (ct) = \ £ COS 2 2^1 . . . cos 2 ZE^£i 
i=l 

< ilcos 2 ^ = Ill(l+cos^f^ 

1=1 " 1=1 v 

- I + 1 f cos 2g *--gj( g ) 

i=l 

— 2^2' 

The number of qubits used by this QBP is q = 0(loglogm + 1), I = Therefore, the width of the 

I v m I 

program is 2 9 = 0{2 l/, f 1 logm). 

□ 

The generalized approach can be used to construct an effective quantum OBDD for the Boolean 
variant of the Hidden Subgroup Problem. 



4.1 The upper bound for Hidden Subgroup Function 

This problem was first defined and considered in [8], where the following Boolean variant of the Hidden 
Subgroup Problem was defined. 

Definition 6. Let K be a normal subgroup of a finite group G. Let X be a finite set. For a sequence 
X E Xl G l let o = bin(x) be its representation in binary. If a encodes no correct sequence X = Xl ■ ■ ■ X\G\> 
then Hidden Subgroup function of o is set to be zero, otherwise: 

( 1, if \/a£GVi,j£aK(Xi = Xj) 
HSP G , K (ct) = < and \/a,b£GVi£aKV j£ bK (aK / bK Xi Xj)\ 
\ 0, otherwise. 

Let / be the function encoded by the input sequence. We want to know if a function / : G — ► X 
"hides" the subgroup K in the group G. Our program receives G and K as parameters, and function / 
as an input string containing values of / it takes on G. The values are arranged in lexicographical order. 
See Definition [6] 
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We make two assumptions. First, we assume that the set X contains exactly (G : K) elements. In- 
deed, having read the function /, encoded in the input sequence a, we have X to be the set of all different 
values that / takes. Obviously, if \X\ is less or greater than (G : K), then HSPg.a: (<t) = 0. The second as- 
sumption, is that we replace all values of / by numbers from 1 through (G : K). Thus, HSPg.a: (*i, • ■ ■ ,x„) 
is a Boolean function of n = \G\ [logG : K] variables. In these two assumptions the following theorem 
holds. 

Theorem 4. Function HSPg.k (jc) can be computed with one-sided error by a quantum OBDD of width 
0(n). 

Proof. First we shall prove the following lemma. 

Lemma 3. In order to correctly compute HSPg,k (x) it is enough to perform following calculations. 

1. For every coset we check equalities for all input sequence values that have indices from this coset; 

2. From every coset we choose a representative, and check if the sum of values of f on all the repre- 
sentatives equals to the following value 

S - G fj- (G:K)((G:K) + 1) ^ 

Proof. One direction is straightforward. The other direction is also not difficult. Suppose we have the 
two conditions of the lemma satisfied. Let aK and bK be two different cosets with elements d G aK and 
c G bK, such that Od = o c . We fix c G bK. There are two cases possible: 

1. For all d G aK{Od = a c ); 

2. There exists d' G aK(a ( j ^ c c ). 

Apparently in the first case we indeed could choose any of the elements of a coset to check inequalities. 
In the second case the first condition of the lemma would fail. The reasoning for bK is analogous. 

When the values of / are different on different cosets, obviously, the sum of these values is the sum 
of numbers from 1 through G : K. Therefore, HSPg,a- (cr) = 1 iff both conditions of the lemma are 
satisfied. □ 

According to the previous lemma, HSPg,a: (jc) has a characteristic consisting of two polynomials over 
Z2« , checking conditions of the lemma. We shall construct them explicitly to show they are linear. 

We shall adopt another indexation of % when convenient: Xa,q is a value of / on the q-th element of 
the coset aK. 

Therefore, for a binary input symbol xj we define 

• a = a(j) for the number of the corresponding coset; 

• q = q(j) for the number of the corresponding element of the coset a; 

• r = r(j) for the number of bit in the binary representation of %a,q 

and start indexation from 0. Thus a G {0, . . . , (G : K) — 1},# G {0, . . . , \aK\ — 1}. 
In this notation the polynomials are: 

1- 8i(x) =L a L q ^ ]K]a+qmosG:K \Xa, q -X a , q -imod\K\)- Thus, gl (x) =0 iff for every coset a function 
/ maps all the elements of a onto the same element of X. 

2. gi{x) = (rjj^P Xij-^j —S, where Xij is the representative chosen from the y'-th coset. Therefore, 

gi(x) checks whether the images of elements from different cosets are distinct. 
By the generalized fingerprinting technique we can construct quantum OBDD of width 0(n), com- 
puting HSPg.a: (jc) with one-sided error. □ 
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A Proof of Lemma |2] 

Proof. Using Azuma's inequality (see, e.g., ifTUl ') we prove that a random choice of the set K is "good" 
with positive probability . 

Let 1 < g < m — 1 and let K be the set of t parameters selected uniformly at random from {0, . . . , m — 

1}. 

We define random variables X,- = cos -^-^ and Y k = £f =1 X,-. We want to prove that Azuma's inequal- 
ity is applicable to the sequence Yq = 0, Y\, Y2, Y3, . . . , i.e. it is a martingale with bounded differences. 
First, we need to prove that E [Y k ] < 00. 

From the definition of X, it follows that 

. . 1 V 2% jg 
E[Xi] = — Y cos — — 
m r^ Q m 

Consider the following weighted sum of with roots of unity 

I Vexp = - • ""P"- 1 = 0, 

m p~o V m ) m sxp{2Kig/m) — 1 

since g is not a multiple of m. 

E [Xi\ is exactly the real part of the previous sum and thus is equal to 0. 
Consequently, E[Y k ] = I- =1 £[X] = < 00. 

Second, we need to show that the conditional expected value of the next observation, given all the 
past observations, is equal to the last observation. 

E[Y k+1 \Y h ...,Y k ] = — > F A - + cos =Y k + - > cos = Y k 

m \ m J m m 

Since — Y k \ = \X k+i \ < 1 for k > we apply Azuma's inequality to obtain 

Pr(\Y t -Yo\>X)=Prnj^Xi\>k \ <2exp^-^ 
Therefore, we induce that the probability of K being not "good" for 1 < g < m — 1 is at most 

Pr^|tx ; .|>^<2ex P (-f)<I 

for t = [(2/e)ln2m]. 

Hence the probability that constructed set is not "good" for at least one I < g < m — lisat most 
(m — l)/m < 1. Therefore, there exists a set which is "good" for all 1 < g < m — 1. This set will also be 
"good" for all g 7^ mod m because cos 27rt (g+J' m ) _ cos rj 



